How to Set Up UFW Firewall for Your VPS

Wetin UFW be and why you need am

UFW mean Uncomplicated Firewall, and the name talk true. E be friendly front end for the firewall wey Linux kernel already get, so instead make you write raw rules, you fit type short commands like ufw allow 22/tcp. For fresh VPS, every service wey dey listen dey reachable from internet by default. Firewall turn this arrangement around: you deny everything, then allow only the few ports wey you really dey use. This one change remove most of your exposure with about four commands.

Before you touch am, know wetin dey listen, because na those services firewall go decide their fate. Read wetin dey listen with ss -tlnp na the correct first step.

The one rule wey go stop you from locking yourself out

Na dis mistake dey make people fear firewall. You enable UFW with default-deny policy, but you never allow SSH. So once firewall come up, e cut your own connection and you no fit enter again. To avoid am, always allow SSH before you enable UFW. Na the whole trick be dat, and the steps below do am for the safe order.

If e happen to you anyway, you no dey stuck: your provider web console, through VNC or serial, no pass through SSH. So you fit log in there and run ufw disable or add the missing rule.

Step 1: Set default policies

Start by telling UFW make e deny everything wey dey come in and allow everything wey dey go out:

sudo ufw default deny incoming
sudo ufw default allow outgoing

deny incoming na the important part. E mean say any port wey no get explicit allow rule go close to outside, even if service dey listen on am. allow outgoing allow your server reach internet normally for updates and similar work. These two commands change policy only; nothing go enforce until you enable UFW for step 3.

Step 2: Open the ports wey you really need

Before you enable am, open SSH so you no lose your connection:

sudo ufw allow 22/tcp

UFW fit also rate-limit SSH for you: sudo ufw limit 22/tcp go allow the port, but e go block any address wey make six or more connections inside thirty seconds. This one go reduce brute-force scripts without extra software.

If you dey run web server, allow HTTP and HTTPS too:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Allow only the services wey you serve to the public. Database like Postgres for port 5432 almost never suppose get allow rule. Bind am to 127.0.0.1 instead, so na only the machine fit reach am. Every port wey you open na network entry wey you now need defend, so keep the list short.

You fit also build the complete sequence of ufw commands for your server here, then run dem in order:

Step 3: Enable and confirm say e dey on

sudo ufw enable

E warn say the command fit disrupt existing SSH connections. Because you allow 22/tcp for step 2, your session go survive. Confirm the result:

sudo ufw status verbose

Status: active
Default: deny (incoming), allow (outgoing)

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
22/tcp (v6)                ALLOW IN    Anywhere (v6)
80/tcp                     ALLOW IN    Anywhere

Read two things here. Status: active mean say the firewall dey run. And every rule appear two times, one plain and one with (v6), wey tell you say UFW dey cover IPv6 as well as IPv4. If (v6) lines no dey, your IPv6 side no dey managed. Na another trap be that, and the IPv6 firewall post cover am.

Manage rules later

To see rules with numbers so you fit remove one:

sudo ufw status numbered
sudo ufw delete 3

To allow a port only from one address, wey na good way to expose an admin service to only your own IP:

sudo ufw allow from 10.0.0.24 to any port 5432 proto tcp

That method no go work once your own address change or several machines need access. The usual fix na to stop opening the port publicly and reach the service through private network instead. Na this advertising the server's private subnet to your tailnet dey help you do.

Firewall na one layer. E control wetin fit reach a port, but e no slow down person wey dey hammer port wey you leave open, like SSH. For that, add Fail2ban before SSH to ban repeat offenders. Defence in depth mean say each layer cover wetin the others no fit cover.

Firewall only make sense after you know wetin ports be and how services dey listen, and configuring one na step for the first 10 minutes for a new VPS.

FAQ

UFW enable go disconnect my SSH session?

E no go, if you allow SSH first. Run sudo ufw allow 22/tcp before sudo ufw enable, and your connection go survive because firewall don permit port 22 now. The danger na to enable default-deny firewall without SSH allow rule, wey go cut you off. If that one happen, log in through your provider VNC or serial console, then run ufw disable.

Which ports I suppose open for VPS?

Na only the ones wey you dey serve to public. SSH (22/tcp) so you fit manage the box, plus HTTP and HTTPS (80/tcp, 443/tcp) if you dey run website. Leave every other one denied. Internal services like databases suppose bind to 127.0.0.1 and no firewall rule suppose cover dem at all, so dem no go ever reachable from network.

UFW dey handle IPv6?

For modern Ubuntu, yes: IPV6=yes dey set for /etc/default/ufw, so each rule dey apply to both stacks, and ufw status dey show the IPv6 rules with (v6) suffix. The ways wey e fit still go wrong dey covered for the IPv6 firewall trap.

How I go remove UFW rule?

Run sudo ufw status numbered to list the rules with index numbers, then sudo ufw delete N where N na the number of the rule wey you want remove. You fit also delete by specification, for example sudo ufw delete allow 80/tcp.

How I go allow port only from one IP address?

Use from rule instead of plain allow. To make only your office address reach PostgreSQL, run sudo ufw allow from 10.0.0.10 to any port 5432 proto tcp. With default-deny policy, the port dey closed to everybody until rule open am, so this from rule na the only way to enter: the whole internet remain blocked, and only the address wey you specify go pass. No add plain allow 5432/tcp too, because e go open the port to everybody. This na the safest way to expose database or admin panel. Confirm am with sudo ufw status verbose, wey go show the source address beside the port.